introducing the metasploit antiforensics project vinnie liu bluehat

introducing the. . . metasploit antiforensics project vinnie liu, bluehat

speaker • vinnie • anti-forensics researcher • framework contributor • vinnie@metasploit. com

coverage • weaknesses in current forensic techniques • break industry tools • Guidance En. Case, PGP Desktop, NTFS, MS Anti. Spyware, Windows Explorer • Metasploit AF Tools • timestomp, slacker, transmogrify, sam juicer • identify opportunities for improvement

why • airing the forensic dirty laundry. • no pressure to innovate in the forensics community. • too much dependence on forensic tools

talk format • technique • anti-technique • opportunity for improvement, weaknesses, tools, etc. . .

#1 timestamps • technique • timestamps hint as to when an event occurred. • timestamps help an analyst timeline events and profiling hacker behavior. • if an investigator finds a suspicious file, they will search for other files with similar MAC attributes.

#1 timestamps • anti-technique • modify file times, log file entries, and create bogus and misleading timestamps • we need better tools… • most tools only modify the MAC • ok for FAT, but not for NTFS…

#1 timestamps A C • modified (M), accessed (A), created (C) • entry modified (E) M E

tool #1: timestomp • timestomp • uses the following Windows system calls: • Nt. Query. Information. File() • Nt. Set. Information. File() • doesn’t use • Set. File. Time() • features: • display & set MACE attributes • mess with En. Case and MS Anti-Spyware

timestomp @ work • normal • after setting values (-z “Monday 05/05/2005 05: 05 AM”) • example En. Case weakness (-b)

timestomp @ work

timestomp @ work • Windows Explorer Demo

opportunity for improvement • current state • En. Case only uses the Standard Information Attribute (SIA) MFT Entry Header SIA Attribute FN Attribute MACE • opportunity for improvement • use the Filename (FN) attribute Remaining Attributes…

opportunity for improvement • given SIA MACE • the FN MACE values are only updated when a file is created or moved earlier time later time • therefore FN MACE • FN MACE values must be older than SIA MACE values • validation technique • determine if the SIA MACE values are older than the FN MACE values

…but we can bypass that too • anti-validation technique • system files and archives are false positives • use raw disk i/o to change the FN MACE values • $MFT is a file • calculate offsets from the start of the MFT to a file’s FN MACE values • may cause file system instability

…but we can bypass that too • anti-validation technique • use a file that’s not been used in a while, delete the $data attribute and fill it with your own data • no creating, no moving means no FN updates • only the SIA changes & SIA is controllable MFT Entry Header SIA Attribute FN Attribute MACE Data Attribute

#2 location, location • technique • attackers tend to store tools in the same directory • anti-technique • stop using %windir%system 32 • mix up storage locations both on a host and between multiple hosts • 3 rd party software, browser temp, AV/spyware

#3 undelete • technique • forensics tools will make a best effort to reconstruct deleted data • anti-technique • secure file deletion • filename, file data, MFT record entry • wipe all slack space • wipe all unallocated space

#3 undelete • tools • Sys Internals – sdelete. exe • doesn’t clean file slack space • Eraser (heide) • does clean file slack space • PGP Desktop’s Disk Wipe • privacy concerns • vulnerabilities • PGP Desktop’s Disk Wipe

snake oil PGP 8. x and 9. 1 “wiping slack space at end of files…” not so private. . .

#4 signature analysis • technique • En. Case has two methods for identifying file types • file extension • file signatures • anti-technique • change the file extension • changing file signatures to avoid En. Case analysis

foiling signature analysis • unmodified • one byte modified

…flip it and reverse it • tool #2 • transmogrify • does all the work • switch between multiple file formats • exe, jpeg, pdf, gif, txt, and so on. . .

#5 hashing • technique • to minimize search scope and analysis time • create an MD 5 fingerprint of all files on a system • compare to lists of known good & known bad file hashes • anti-technique • modify and recompile • remove usage information • stego works on non-executables as well as executables • direct binary modification

#5 hashing eafcc 942 c 7960 f 921 c 64 c 1682792923 c 4 e 65745 d 42 c 70 ac 0 a 5 f 697 e 22 b 8 bb 033 • direct binary modification (one-byte)

#6 keyword searching • technique • analysts build lists of keywords and search through files, slack space, unallocated space, and pagefiles • anti-technique • exploit the examiner’s lack of language skill • opportunity for improvement • predefined keyword lists in different languages

#7 reverse engineering • technique • 99% of examiners can’t code • possess rudimentary malware analysis skills if any • • binary compression (packer) identification commonly available unpackers run strings behavioral analysis • anti-technique • use uncommon packers or create a custom loader • PEC 2 • packing strategy

#8 profiling • technique • analysts find commonalities between: tools, toolkits, packers, language, location, timestamps, usage info, etc… • anti-technique • use what’s already in your environment

#9 information overload • technique • forensics takes time, and time costs money • businesses must make business decisions, again this means money • no pulling-the-plug. business data takes priority. • anti-technique • on a multi-system compromise, make the investigation cost as much as possible • choose the largest drive • help the investigators

#10 hiding in memory • technique • En. Case Enterprise allows the examiner to see current processes, open ports, file system, etc… • anti-technique • Metasploit’s Meterpreter (never hit disk) • exploit a running process and create threads • opportunity for improvement • capture what’s in memory

tool #3: sam juicer • • grab the password hashes from the SAM built from the ground up, real-world implementation ooooohhh, stealthy! tool name sucks

tool #3: pwdump is no good current state of tools memory/lsass 1. 2. 3. 4. 5. 6. opens a remote share hits disk starts a service to do dll injection hits registry creates remote registry conn often fails and doesn’t clean up services disk registry remote share remote registry

tool #3: the juice is good sam juicer memory/lsass meterpreter channel services disk registry 1. 2. 3. 4. 5. 6. slides over Meterpreter channel direct memory injection never hits disk & never hits the registry never starts a service data flows back over existing connection failure doesn’t leave evidence

tool #4: slacker • hiding files in NTFS slack space • technique • take advantage of NTFS implementation oddity • move logical and physical file pointers in certain ways to avoid having data zeroed out • features • file splitting • multiple selection techniques • obfuscation

tool #4: slacker standard file setup end of file slack space valid data sector sector file pointer 1 cluster = 8 sectors sector end of valid data

tool #4: slacker writing to slack end of valid data end of file sector sector safe NTFS Set. End. Of. File() Set. File. Pointer() zeros data! Write. File() 1 cluster = 8 sectors sector file pointer

tool #4: slacker reading from slack end of valid data end of file sector sector Set. End. Of. File() Set. File. Pointer() Read. File() Set. File. Valid. Data() 1 cluster = 8 sectors sector file pointer

tool #4: slacker closing out end of valid data end of file sector sector Set. End. Of. File() Set. File. Pointer() 1 cluster = 8 sectors sector file pointer

tool #4: slacker • selection • dumb • first N files that have enough combined slack space • random selection of files in a directory • intelligent • selects the oldest files in a directory • each flavor also available with recursion

tool #4: slacker • obfuscation • none • xor key • random 8 bit key repeated over all data • one-time pad Message = 100 bits XOR Key = 100 bits Encrypted Message = 100 bits

tool #4: slacker • one-time pad (sort of. . . ) • strength relies on a truly random xor key of equal length to the message • by using a file. . . • we avoid generating a an xor key • we avoid having to store it anywhere • because its already on the system • BUT, it’s not truly random • EVEN SO, good luck trying to figure out which series of 1 s and 0 s on your hard drive I chose.

tool #4: slacker • Normally, this is where I demo slacker. • but my $20 k USB dongle for En. Case was “reposessed”.

what we’ve defeated 1. temporal locality (time stamps) 2. spatial locality (file location) 3. data recovery 4. file signatures 5. hashing 6. keywords 7. reverse engineering 8. profiling 9. effectiveness/info overload 10. disk access/hiding in memory

more information • what? • slide decks • Metasploit Anti-Forensic Investigation Arsenal (MAFIA) • where? • www. metasploit. com/projects/antiforensics/

thanks microsoft questions comments suggestions vinnie@metasploit. com